Airmagnet, Inc.

Peter Reilly

Robert Vogt

Lei Xiong

Arong Pan

Benjamin Nelson

Matthew D Richards

Blair Pendelton

Daniel Zarrini

Michael Faughan Sleevi

Matthew Richards

A method for processing time series measurement data is provided. Data including a plurality of network performance metrics is received over a plurality of time periods. The received data is written to a plurality of measure data structures. The measure data structures are stored to a two dimensional array having a first dimension and a second dimension. The first dimension represents time and the second dimension represents a plurality of network entities. Elements of the two-dimensional array are compressed into BLOBs. Each one of the BLOBS is associated with a time period and a measure type associated with the data stored within a corresponding BLOB. The BLOBS are stored in a first table and second table. The first table is indexed by a combination of a network entity and a time period. The second table is indexed by a combination of a network performance metric and a network entity.

Efficient storage and querying of time series metrics

A method for continuous data anomaly detection includes identifying a period of time covered by metrics data stored in a repository. The stored metrics data is categorized into a plurality of non-overlapping time segments. Statistical analysis of the stored metrics data is performed based on the identified period of time. A range of acceptable metric values is dynamically generated based on the performed statistical analysis.

Plato anomaly detection

A distributed network traffic flow monitoring system is provided. The system includes a plurality of network packet flow collector devices for receiving netflow packets associated with a traffic flow activity data at a network connection. The traffic flow activity data includes one or more transmissions between particular source and destination IP addresses. The system further includes a network packet flow coordinator device connected to the plurality of network packet flow collector devices and configured to aggregate probabilistic information related to the traffic flow activity data from the one or more of network packet flow collector devices and to estimate cardinality of the traffic flow activity data based on the aggregated probabilistic information.

Method and apparatus of estimating conversation in a distributed netflow environment

A storage system includes network monitoring device having NIC coupled to network and configured to capture raw data packets. The system further includes 4 data repositories. A first repository stores captured packets. A second repository stores captured packets' metadata. A third repository stores captured packets' and metadata's timestamp indexed data. A fourth repository stores captured packets' data flow. The storage system further includes a storage engine coupled to the repositories. The storage engine receives packet search criteria specifying at least a first time range. Data flow information associated with the search criteria is retrieved from the fourth repository. The retrieved data flow information is associated with a second, narrower, time range. Metadata information associated with the second time range is retrieved from the second repository using corresponding timestamp indexed data. Captured packets associated with the retrieved metadata are retrieved from the first repository using corresponding timestamp indexed data.

Growing community of inventors

Colorado Springs, CO, United States of America

Peter Reilly